How to enable Controlled Folder Access anti-ransomware feature on Windows 10/11

Controlled Folder Access is a feature of Microsoft's Windows Security desktop antivirus application. It prevents ransomware by preventing files in protected folders from being modified. Enabling Controlled Folder Access prevents untrusted applications, malware, or other means from changing files in protected folders.

Controlled Folder Access is an additional security feature in Windows 10 and 11 that some users appreciate. Ransomware is not something to be taken lightly and enabling this feature will keep your system and user files extra safe. Here are 4 ways you can enable Controlled Folder Access in Windows.

How to enable Controlled Folder Access in Windows Security

The Controlled Folder Access setting is located under Ransomware Protection in the Windows Security app. It's easy to find and turn it on/off once you know where it is. Here's how to turn on Controlled Folder Access in the Windows Security app.

1. To open the Windows Security application , double-click its system tray icon.

2. Select the Virus & threat protection tab of Windows Security.

3. Click Manage ransomware protection to go to Controlled Folder Access settings.

4. Now, turn on the Controlled Folder Access option to enable that feature.

Controlled Folder Access protects the Documents, Videos, Pictures, and Music user folders when enabled. To see a list of protected user folders, click Protected folder. You can add more to the list by clicking the Add protected folder button , selecting a folder, and clicking Select Folder.

How to Enable Controlled Folder Access Using PowerShell

Windows PowerShell provides you with an alternative method to enable and disable Controlled Folder Access by executing commands. You can enable Controlled Folder Access using PowerShell as follows:

1. To activate the file search tool, press Win + S .

2. Type PowerShell in the enabled search utility.

3. Open PowerShell with admin rights by selecting Run as administrator .

4. To enable Controlled Folder Access, type this command text and press Enter :

Set-MpPreference -EnableControlledFolderAccess Enabled

5. You can disable Controlled Folder Access by executing this command:

Set-MpPreference -EnableControlledFolderAccess Disabled

How to enable Controlled Folder Access with Group Policy Editor

If you have Windows 11 Pro or Enterprise, you can enable Controlled Folder Access using the Group Policy Editor. The Group Policy Editor also includes some additional configuration settings for Controlled Folder Access. Here's how to enable Controlled Folder Access via GPE.

Note : If you are using Windows Home, Group Policy Editor will not appear by default.

1. Open the Windows search tool and type gpedit.msc in it.

2. Select gpedit.msc to display the Group Policy Editor.

3. Click Computer Configuration > Administrative Templates in the left pane of Group Policy Editor.

4. Double-click Windows Components to expand it.

5. Click the arrows to expand Microsoft Defender Antivirus and Microsoft Defender Exploit Guard .

6. Select Controlled Folder Access to view the policy settings for that feature.

7. Then double-click on Configure Controlled folder access to see that setting's window.

8. Select Enabled for the Configure Controlled folder access window .

9. Click Block on the drop-down menu to select the strictest CFA mode. However, you can also select the Audit Mode, Block disk notification only , and Audit disk notification only options to allow Controlled Folder Access.

10. Select Apply in the Configure Controlled folder access window .

11. Click the OK button of the Configure Controlled folder access window .

How to enable Controlled Folder Access from Windows context menu

Alternatively, you can create a context menu shortcut to enable/disable Controlled Folder Access. Then you will be able to access the Turn on Controlled folder access setting from the Windows desktop area. You can add such a CFA option to the right-click menu by setting up and running a registry script as follows:

1. Open Notepad.

2. Then select this script text and press Ctrl + C :

Windows Registry Editor Version 5.00


 ; Created by: Shawn Brink

 ; Created on: July 19th 2018

 ; Tutorial: https://www.tenforums.com/tutorials/114389-add-turn-off-controlled-folder-access-context-menu-windows-10-a.html
 

 [HKEY_CLASSES_ROOT\DesktopBackground\Shell\ControlledFolderAccess]

 "HasLUAShield"=""

 "Icon"="%ProgramFiles%\\Windows Defender\\EppManifest.dll,-101"

 "MUIVerb"="Turn On or Off Control folder access"

 "Position"="Bottom"

 "SubCommands"=""
 

 [HKEY_CLASSES_ROOT\DesktopBackground\Shell\ControlledFolderAccess\shell\001flyout]

 "MUIVerb"="Turn on Control folder access"

 "HasLUAShield"=""

 "Icon"="%ProgramFiles%\\Windows Defender\\EppManifest.dll,-101"


 [HKEY_CLASSES_ROOT\DesktopBackground\Shell\ControlledFolderAccess\shell\001flyout\command]

 @="PowerShell -windowstyle hidden -Command \"Start-Process cmd -ArgumentList '/s,/c,start PowerShell.exe Set-MpPreference -EnableControlledFolderAccess Enabled' -Verb RunAs\""


 [HKEY_CLASSES_ROOT\DesktopBackground\Shell\ControlledFolderAccess\shell\002flyout]

 "MUIVerb"="Turn off Control folder access"

 "HasLUAShield"=""

 "Icon"="%ProgramFiles%\\Windows Defender\\EppManifest.dll,-101"
 

 [HKEY_CLASSES_ROOT\DesktopBackground\Shell\ControlledFolderAccess\shell\002flyout\command]

 @="PowerShell -windowstyle hidden -Command \"Start-Process cmd -ArgumentList '/s,/c,start PowerShell.exe Set-MpPreference -EnableControlledFolderAccess Disabled' -Verb RunAs\""

3. Paste that script into Notepad by clicking on the application's window and pressing Ctrl + V .

4. Next, press Ctrl + Shift + S to view Notepad's Save as window .

5. Set the Save as type option to All files .

6. Type Turn on Control folder access.reg inside the file name box.

7. Choose to save the script to the desktop location.

8. Click Save to add the Turn on Control folder access registry file to the desktop.

9. Close the Notepad editor and double-click the Turn on Control folder access.reg file on the desktop.

10. Select Yes to confirm that you trust the script.

You can now enable Controlled Folder Access from the Windows context menu.